Threat briefs

The Robots-Validate Perl module (versions 0.4.3 through 0.4.9) fails to clear User-Agent matcher state between requests, causing legitimate clients to be incorrectly classified as imposter robots.

An authentication bypass vulnerability in JetBrains YouTrack Helpdesk allows unauthenticated attackers to hijack any user account, including administrators, by spoofing emails to trigger an insecure account merging process.

The Amazon SageMaker Python SDK fails to verify S3 bucket ownership in the default_bucket() function, allowing attackers to pre-create predictable buckets for IAM credential theft or remote code execution.

Apache Traffic Server is vulnerable to request smuggling due to the improper handling of shared origin connections when client request bodies are incomplete, allowing cache poisoning and access control bypass.

The regcomp function in musl libc is affected by multiple integer overflow issues which can lead to incorrectly-sized allocations and out-of-bounds heap writes.

Django REST framework versions prior to 3.18.2 are susceptible to a Denial of Service attack where specially crafted Accept headers cause CPU-intensive parsing and thread exhaustion.

Django REST framework versions 3.12.0 through 3.18.1 contain a logic flaw where TokenProxy.delete() uses an incorrect primary key, causing credential revocation attempts to fail silently.

A vulnerability in file-management-system (commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df) allows for unrestricted file upload via the FileController.php store function.

A buffer overflow vulnerability exists in the Tenda BE3L Pro (version 16.03.60.62) within the formWifiBasicSet function of the /goform/WifiBasicSet file. The flaw is triggered via the security_5g argument and can be initiated remotely.

Apache Pulsar Manager is vulnerable to missing authentication and authorization, leading to potential administrative credential disclosure, and will not receive patches due to the project reaching end-of-life status.

MongoDB Compass is vulnerable to arbitrary code execution when processing specially crafted BSON values from a stored view aggregation pipeline during an editing operation.

CVE-2026-114267 affects SourceCodester Food Order Management System 1.0, where an unknown function in the Admin Endpoint component exhibits missing authorization.

LocalAI versions 4.6.0 through 4.11.0 are vulnerable to server-side request forgery (SSRF) allowing attackers to exfiltrate internal metadata via malicious configuration URLs.

A vulnerability in ProjectWorlds Advanced Library Management System 1.0 allows remote SQL injection via the roll_number argument in individual_report_search.php.

The multicluster-global-hub-operator-bundle is configured with overly broad RBAC permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts.

A missing authentication vulnerability in the MomoTommy file-management-system Files API allows remote attackers to manipulate request arguments to gain unauthorized access to file operations.

A SQL injection vulnerability exists in the Login function of admin_class.php in oretnom23 file-management-system-php, caused by the manipulation of the username or password arguments.

Xxyopen Novel version 3.5.0 contains a DOM-based Cross-Site Scripting vulnerability in its comment module, allowing attackers to execute arbitrary JavaScript in the context of other users' sessions.

Open eClass version 3.15 is susceptible to remote code execution, as detailed by a public exploit proof-of-concept published to Exploit-DB.

NTPsec ntpd versions 1.1.4 through 1.2.5 are vulnerable to a remote denial-of-service attack due to an out-of-bounds read flaw triggered by malformed NTS extension fields.

Apache bRPC versions prior to 1.18.0 are vulnerable to stack exhaustion and process crashes when processing maliciously crafted, deeply nested mcpack data requests.

Cisco has released software hardening updates to address multiple vulnerabilities discovered during an internal security review of several Unified Communications products.

Cisco has released a software hardening update to address eight vulnerabilities (CVE-2026-76490 through CVE-2026-76497) identified during an internal security review of the Expressway Core and Edge series.

Cisco released security hardening updates for the Snort 3 engine to address multiple internally discovered vulnerabilities, including out-of-bounds write issues categorized as CWE-787.

Apache IoTDB versions 2.0.0 through 2.0.10 contain a privilege escalation vulnerability where the Legacy Pipe receiver protocol uses a hardcoded root identity to perform unauthorized data operations.

OpenChoreo API server allows authenticated users with workflow update permissions to hijack ownership of cross-project WorkflowRuns, leading to unauthorized access to logs, build credentials, and workflow modification.

A stored cross-site scripting (XSS) vulnerability in the Brainstorm Force SureCart plugin (versions 4.9.5 and earlier) due to improper neutralization of input during web page generation.

WPdreams Ajax Search Lite (up to version 4.14.6) contains a Blind SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command.

The Geo Mashup software by Dylan Kuhn is vulnerable to Reflected Cross-site Scripting (XSS) due to improper neutralization of input during web page generation.

VideoWhisper Paid Videochat Turnkey Site (from n/a through 7.5.14) is vulnerable to Reflected Cross-site Scripting (XSS) due to improper neutralization of input during web page generation.